When it comes to the crossrider sidepanel, I prefer using an iframe over js-injected html to avoid interference with the rest of the page. However, I am struggling to establish any interaction between my browser extension and the iframe.
I believe adding a sidepanel with an extension is pointless unless there can be some basic JS communication involved. My goal is to incorporate options like checkboxes in the iframe that can control the extension. Since the plugin exists, I assume there must be a way to achieve this.
My ideal scenario would involve handling basic input in the child iframe and sending save/load commands back to the extension. Is message passing the answer here? And if so, which API should I use for this purpose?
I found a related query on Stack Overflow: Accessing iframe from chrome extension
[EDIT]
After trying out a few approaches...
It appears that the expected practice is to host the iframe's HTML content externally. This seems odd as it should ideally be available locally within the extension. Hosting externally becomes inconvenient when you need to view pages offline. I find this unnecessary and have decided to disregard it as an option.
Another method I tested was providing the HTML directly for the sidebar without placing it inside an iframe. I personally prefer iframes because they keep CSS and JS separate, minimizing interference between the page and the extension.
So, I attempted creating an iframe through the `html` sidebar attribute with an ID, and injected the content after a 100ms delay using `myiframe.contentWindow.document.open/writeln/close()`. While this works well in Chrome, it fails in Firefox due to a security error (`The operation is insecure` on `open()`).
A different approach involves providing the iframe content through the `src` URL (for sidebar, I used a data address for the `url` attribute): Html code as IFRAME source rather than a URL. While this method worked in Firefox, it triggered a CORS error in Chrome stating `The frame requesting access has a protocol of "http", the frame being accessed has a protocol of "data". Protocols must match.` as well as `Warning: Blocked a frame with origin "http://localhost" from accessing a cross-origin frame. Function-name: appAPI.message.addListener`.
These CORS issues seem illogical to me. It's all originating from my code within the same extension, injected into the same page. There shouldn't be any cross-origin problems since I created it all. If I have the authority to modify the origin, then worrying about security measures feels redundant.